@nextage/nx-frame-be 1.0.46 → 1.0.48

package/build/common/base/__test__/tenancy-opt-out.test.js

@@ -32,6 +32,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const constants_1 = require("../../constants");
 const base_model_1 = require("../base.model");
 const mongo_utils_1 = require("../mongo-utils");
+const mongo_utils_2 = require("../mongo-utils");
 const enums_1 = require("../../enums");
 /** Marks a document every tenant shares, as an application would mark it. */
 const SHARED = '__GLOBAL__';
@@ -125,6 +126,17 @@ describe('a model that overrides nothing is scoped anyway', () => {
         yield expect(unaware.remove(doc.id, outsider)).rejects.toBeDefined();
         expect(yield unaware.mgModel.collection.countDocuments({})).toBe(1);
     }));
+    // A refusal that only happens when the document EXISTS is an oracle: delete an id at
+    // random and the answer tells you whether it names something in somebody else's tenant.
+    // The two outcomes must therefore be indistinguishable - the existence of another
+    // tenant's document is not a fact this caller is entitled to learn.
+    it('refuses a delete the same way whether the document is missing or another tenant\'s', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A' }, owner);
+        const missing = (0, mongo_utils_2.genObjectId)().toHexString();
+        const foreign = yield unaware.remove(doc.id, outsider).then(() => null, (e) => e.constructor.name);
+        const absent = yield unaware.remove(missing, outsider).then(() => null, (e) => e.constructor.name);
+        expect(absent).toBe(foreign);
+    }));
     it('refuses to update another tenant document', () => __awaiter(void 0, void 0, void 0, function* () {
         const doc = yield unaware.create({ code: 'A' }, owner);
         yield expect(unaware.update(doc.id, { code: 'B' }, outsider)).rejects.toBeDefined();

package/build/common/base/base.model.d.ts

@@ -214,6 +214,13 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      * id. The document is re-read unscoped on purpose - the point is to judge its real
      * owner, and a scoped read would hide the very case being guarded against.
      *
+     * A MISSING document is refused in exactly the same way as a foreign one, and that is
+     * not defensive coding: refusing only when the document exists turns this hook into an
+     * oracle. Delete an id at random and the outcome answers a question the caller was
+     * never entitled to ask - whether that id names something in somebody else's tenant.
+     * The two cases are therefore made indistinguishable, which costs nothing: deleting an
+     * id that matches nothing had no effect to begin with.
+     *
      * @param {*} id
      */
     beforeRemove(id: string, context: NxContext): Promise<string>;

package/build/common/base/base.model.js

@@ -410,12 +410,21 @@ class BaseModel extends events_1.EventEmitter {
      * id. The document is re-read unscoped on purpose - the point is to judge its real
      * owner, and a scoped read would hide the very case being guarded against.
      *
+     * A MISSING document is refused in exactly the same way as a foreign one, and that is
+     * not defensive coding: refusing only when the document exists turns this hook into an
+     * oracle. Delete an id at random and the outcome answers a question the caller was
+     * never entitled to ask - whether that id names something in somebody else's tenant.
+     * The two cases are therefore made indistinguishable, which costs nothing: deleting an
+     * id that matches nothing had no effect to begin with.
+     *
      * @param {*} id
      */
     beforeRemove(id, context) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.tenancy && id) {
                 const doc = yield this.mgModel.findOne({ _id: (0, mongo_utils_1.toObjectId)(id) });
+                if (!doc)
+                    throw new errors_1.ForbiddenError();
                 this.assertWritable(doc, context);
             }
             return id;

package/build/common/graphql/__test__/generator.overrides.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/common/graphql/__test__/generator.overrides.test.js

@@ -0,0 +1,116 @@
+"use strict";
+/* -------------------------------------------------------------------------- */
+/*  Per-operation @auth role overrides                                        */
+/*                                                                            */
+/*  These tests assert the SDL emitted by the generator, not a running server: */
+/*  the point is WHICH directive is attached to WHICH generated operation.     */
+/*  Mounting Apollo here is impossible anyway, since registering the same      */
+/*  controller twice collides on `type Mutation`.                              */
+/* -------------------------------------------------------------------------- */
+Object.defineProperty(exports, "__esModule", { value: true });
+const coded_entity_controller_1 = require("../../models/coded-entity.controller");
+const generator_1 = require("../generator");
+const loader_1 = require("../loader");
+const READ = 'READ_ROLE';
+const WRITE = 'WRITE_ROLE';
+const NARROW = 'CROSS_TENANT_ROLE';
+/**
+ * `loadSchema` APPENDS to the process-wide `mainSchema`, so every scenario has to
+ * start from an empty accumulator or it would read the previous scenario's SDL.
+ */
+function generate(roles) {
+    loader_1.mainSchema.typeDefs.query = '';
+    loader_1.mainSchema.typeDefs.mutation = '';
+    loader_1.mainSchema.typeDefs.subscription = '';
+    loader_1.mainSchema.typeDefs.type = '';
+    loader_1.mainSchema.resolvers = {};
+    (0, generator_1.generateSchema)(coded_entity_controller_1.ceCtrl, roles ? { roles } : {});
+    return {
+        query: loader_1.mainSchema.typeDefs.query,
+        mutation: loader_1.mainSchema.typeDefs.mutation,
+        subscription: loader_1.mainSchema.typeDefs.subscription
+    };
+}
+/**
+ * Return the `@auth` directive argument attached to one generated operation, or
+ * `null` when the operation is absent from the SDL.
+ *
+ * IMPORTANT: the match is anchored on the FIELD (`name(`), never on the bare name:
+ * `codedEntity` is a prefix of `codedEntityList`, and asserting on the bare name
+ * would silently read the wrong line.
+ */
+function authOf(sdl, operation) {
+    var _a;
+    const line = sdl.split('\n').find(l => l.trim().startsWith(`${operation}(`));
+    if (!line)
+        return null;
+    const match = line.match(/@auth(\(requires: "[^"]*"\))?/);
+    return match ? ((_a = match[1]) !== null && _a !== void 0 ? _a : '') : null;
+}
+const requires = (roles) => `(requires: "${roles}")`;
+/* -------------------------------------------------------------------------- */
+/*  Default behaviour (non-regression)                                        */
+/* -------------------------------------------------------------------------- */
+it('keeps read on queries and write on mutations when no override is given', () => {
+    const sdl = generate({ read: READ, write: WRITE });
+    expect(authOf(sdl.query, 'codedEntityCount')).toEqual(requires(READ));
+    expect(authOf(sdl.query, 'codedEntityList')).toEqual(requires(READ));
+    expect(authOf(sdl.query, 'codedEntity')).toEqual(requires(READ));
+    expect(authOf(sdl.query, 'findOneCodedEntity')).toEqual(requires(READ));
+    expect(authOf(sdl.mutation, 'createCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'updateCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'removeCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'copyCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'bulkRemoveCodedEntity')).toEqual(requires(WRITE));
+});
+it('emits a bare @auth when a role list is not configured', () => {
+    const sdl = generate({ write: WRITE });
+    expect(authOf(sdl.query, 'codedEntityList')).toEqual('');
+    expect(authOf(sdl.mutation, 'removeCodedEntity')).toEqual(requires(WRITE));
+});
+it('still accepts a plain role list as read and write', () => {
+    const sdl = generate([READ, WRITE]);
+    expect(authOf(sdl.query, 'codedEntityList')).toEqual(requires(`${READ},${WRITE}`));
+    expect(authOf(sdl.mutation, 'removeCodedEntity')).toEqual(requires(`${READ},${WRITE}`));
+});
+/* -------------------------------------------------------------------------- */
+/*  Overrides                                                                 */
+/* -------------------------------------------------------------------------- */
+it('narrows a single mutation and leaves its siblings on write', () => {
+    const sdl = generate({ read: READ, write: WRITE, overrides: { remove: NARROW } });
+    expect(authOf(sdl.mutation, 'removeCodedEntity')).toEqual(requires(NARROW));
+    expect(authOf(sdl.mutation, 'createCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'updateCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'copyCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'bulkRemoveCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(sdl.mutation, 'removeCodedEntityArrayItem')).toEqual(requires(WRITE));
+});
+it('narrows a single query and leaves its siblings on read', () => {
+    const sdl = generate({ read: READ, write: WRITE, overrides: { list: NARROW } });
+    expect(authOf(sdl.query, 'codedEntityList')).toEqual(requires(NARROW));
+    expect(authOf(sdl.query, 'codedEntityCount')).toEqual(requires(READ));
+    expect(authOf(sdl.query, 'codedEntity')).toEqual(requires(READ));
+    expect(authOf(sdl.query, 'findOneCodedEntity')).toEqual(requires(READ));
+});
+it('joins a multi-role override into a single requires argument', () => {
+    const sdl = generate({ read: READ, write: WRITE, overrides: { remove: [NARROW, 'ADMIN'] } });
+    expect(authOf(sdl.mutation, 'removeCodedEntity')).toEqual(requires(`${NARROW},ADMIN`));
+});
+/* -------------------------------------------------------------------------- */
+/*  Fail-safe                                                                 */
+/* -------------------------------------------------------------------------- */
+it('falls back to the default instead of publishing the operation when an override is empty', () => {
+    const empty = generate({ read: READ, write: WRITE, overrides: { remove: [], list: '' } });
+    expect(authOf(empty.mutation, 'removeCodedEntity')).toEqual(requires(WRITE));
+    expect(authOf(empty.query, 'codedEntityList')).toEqual(requires(READ));
+    const missing = generate({ read: READ, write: WRITE, overrides: { remove: undefined } });
+    expect(authOf(missing.mutation, 'removeCodedEntity')).toEqual(requires(WRITE));
+});
+/* -------------------------------------------------------------------------- */
+/*  Subscriptions                                                             */
+/* -------------------------------------------------------------------------- */
+it('does not let an override reach the subscriptions, which always follow read', () => {
+    const sdl = generate({ read: READ, write: WRITE, overrides: { remove: NARROW } });
+    expect(sdl.subscription.match(new RegExp(`@auth\\(requires: "${READ}"\\)`, 'g'))).toHaveLength(3);
+    expect(sdl.subscription).not.toContain(NARROW);
+});

package/build/common/graphql/generator.js

@@ -79,6 +79,19 @@ exports.foldedEntityFields = {
   `
 };
 exports.mainSubChannel = 'mainCH';
+/**
+ * Every base operation generated by generateTypeDefs, in declaration order.
+ */
+const baseMethodNames = [
+    'count', 'list', 'get', 'findOne',
+    'create', 'update', 'remove', 'copy',
+    'addArrayItem', 'updateArrayItem', 'removeArrayItem',
+    'bulkUpdate', 'bulkRemove'
+];
+/**
+ * Base operations that default to the `read` roles; every other one defaults to `write`.
+ */
+const readMethodNames = ['count', 'list', 'get', 'findOne'];
 /**
  *
  * @param modelName
@@ -119,24 +132,52 @@ function getSubscriptionNames(modelName) {
     };
 }
 /**
+ * Formats a role list as an `@auth` directive argument list.
+ *
+ * @param roles
+ * @returns `(requires: "ROLE_A,ROLE_B")`, or an empty string when no role is required
+ */
+function toAuthDirective(roles) {
+    if (!roles)
+        return '';
+    return `(requires: "${Array.isArray(roles) ? roles.join(',') : roles}")`;
+}
+/**
+ * Resolves the `@auth` directive of every generated operation.
+ *
+ * Read operations default to `roles.read` and the remaining ones to `roles.write`; a per-operation
+ * entry in `roles.overrides` replaces that default for that operation only.
+ *
+ * IMPORTANT: an override is applied only when it carries roles. An entry whose value is empty or
+ * undefined is treated as ABSENT and the default stands, because the alternative fails OPEN: a
+ * mistyped constant, or one that did not resolve, would silently strip the directive and publish
+ * the operation to everyone. An operation meant to require no role is expressed by leaving the
+ * module's `roles` out, not by an empty override.
  *
  * @param extension
- * @returns
+ * @returns the directive suffix of each base operation, empty string when unconstrained
  */
 function getAuth(extension = {}) {
-    const roles = { read: '', write: '' };
+    var _a;
+    const methods = {};
+    const auth = { read: '', write: '', methods };
+    for (const method of baseMethodNames)
+        methods[method] = '';
     if (!extension.roles)
-        return roles;
+        return auth;
     if ((0, utils_1.isString)(extension.roles))
         extension.roles = extension.roles.split(',');
     if (Array.isArray(extension.roles))
         extension.roles = { read: extension.roles, write: extension.roles };
     const sr = extension.roles;
-    if ((sr.read))
-        roles.read = `(requires: "${Array.isArray(sr.read) ? sr.read.join(',') : sr.read}")`;
-    if (sr.write)
-        roles.write = `(requires: "${Array.isArray(sr.write) ? sr.write.join(',') : sr.write}")`;
-    return roles;
+    auth.read = toAuthDirective(sr.read);
+    auth.write = toAuthDirective(sr.write);
+    for (const method of baseMethodNames) {
+        const override = (_a = sr.overrides) === null || _a === void 0 ? void 0 : _a[method];
+        const fallback = readMethodNames.includes(method) ? auth.read : auth.write;
+        methods[method] = (override === null || override === void 0 ? void 0 : override.length) ? toAuthDirective(override) : fallback;
+    }
+    return auth;
 }
 /**
  *
@@ -163,23 +204,23 @@ function generateTypeDefs(ctrl, schemaExtension = {}, mergeCodedEntity, readOnly
         dataFields = exports.codedEntityFields;
     const baseTypeDefs = {
         query: `
-      ${methods.count}(params: ${modelName}Query)                             : Int!            @auth${roles.read}
-      ${methods.list}(params: ${modelName}Query, pagination: OffsetPagination): [${modelName}]! @auth${roles.read}
-      ${methods.get}(id: ID!)                                                 : ${modelName}!   @auth${roles.read}
-      ${methods.findOne}(params: ${modelName}Query)                           : ${modelName}    @auth${roles.read}
+      ${methods.count}(params: ${modelName}Query)                             : Int!            @auth${roles.methods.count}
+      ${methods.list}(params: ${modelName}Query, pagination: OffsetPagination): [${modelName}]! @auth${roles.methods.list}
+      ${methods.get}(id: ID!)                                                 : ${modelName}!   @auth${roles.methods.get}
+      ${methods.findOne}(params: ${modelName}Query)                           : ${modelName}    @auth${roles.methods.findOne}
     `,
         mutation: `
-      ${methods.create}(item: ${modelName}Input!)                             : ${modelName}! @auth${roles.write}
-      ${methods.update}(id: ID!, item: ${modelName}Input!)                    : ${modelName}! @auth${roles.write}
-      ${methods.remove}(id: ID!)                                              : ${modelName}! @auth${roles.write}
-      ${methods.copy}(id: ID!, item: ${modelName}Input!)                      : ${modelName}! @auth${roles.write}
+      ${methods.create}(item: ${modelName}Input!)                             : ${modelName}! @auth${roles.methods.create}
+      ${methods.update}(id: ID!, item: ${modelName}Input!)                    : ${modelName}! @auth${roles.methods.update}
+      ${methods.remove}(id: ID!)                                              : ${modelName}! @auth${roles.methods.remove}
+      ${methods.copy}(id: ID!, item: ${modelName}Input!)                      : ${modelName}! @auth${roles.methods.copy}
 
-      ${methods.addArrayItem}(id: ID!, item: AddArrayElemItem!)               : ${modelName}! @auth${roles.write}
-      ${methods.updateArrayItem}(id: ID!, item: UpdateArrayElemItem!)         : ${modelName}! @auth${roles.write}
-      ${methods.removeArrayItem}(id: ID!, item: RemoveArrayElemItem!)         : ${modelName}! @auth${roles.write}
+      ${methods.addArrayItem}(id: ID!, item: AddArrayElemItem!)               : ${modelName}! @auth${roles.methods.addArrayItem}
+      ${methods.updateArrayItem}(id: ID!, item: UpdateArrayElemItem!)         : ${modelName}! @auth${roles.methods.updateArrayItem}
+      ${methods.removeArrayItem}(id: ID!, item: RemoveArrayElemItem!)         : ${modelName}! @auth${roles.methods.removeArrayItem}
 
-      ${methods.bulkUpdate}(ids: [ID]!, items: [${modelName}Input]!)          : [${modelName}]! @auth${roles.write}
-      ${methods.bulkRemove}(ids: [ID]!)                                       : [${modelName}]! @auth${roles.write}
+      ${methods.bulkUpdate}(ids: [ID]!, items: [${modelName}Input]!)          : [${modelName}]! @auth${roles.methods.bulkUpdate}
+      ${methods.bulkRemove}(ids: [ID]!)                                       : [${modelName}]! @auth${roles.methods.bulkRemove}
     `,
         subscription: `
       ${subscriptions.create.id}(channelId: String!, filter: ${modelName}Query): ${modelName}! @auth${roles.read}

package/build/common/graphql/interfaces.d.ts

@@ -64,4 +64,28 @@ export interface NxGraphQLSchemaExtension extends NxGraphQLSchemaData {
 export interface NxGraphQLSchemaRole {
     read?: string | string[];
     write?: string | string[];
+    overrides?: NxGraphQLSchemaRoleOverrides;
+}
+/**
+ * Per-operation role overrides.
+ *
+ * Each key is one of the generated base methods (see NxGraphQLBaseMethodNames) and its value
+ * replaces the roles required by that single operation. Operations left out keep the default
+ * behaviour: `read` for count/list/get/findOne, `write` for every other operation.
+ *
+ * IMPORTANT: an empty or undefined value does NOT remove the role constraint, it falls back to
+ * the default. Publishing an operation without any constraint must stay an explicit choice made
+ * by omitting `read`/`write`, never an accident of a half-filled override map.
+ *
+ * Subscriptions are not overridable: they always follow `read`.
+ */
+export type NxGraphQLSchemaRoleOverrides = Partial<Record<keyof NxGraphQLBaseMethodNames, string | string[]>>;
+/**
+ * Resolved `@auth` directive suffixes, ready to be interpolated into the generated SDL.
+ * Each value is either an empty string (no role constraint) or `(requires: "ROLE_A,ROLE_B")`.
+ */
+export interface NxGraphQLAuthDirectives {
+    read: string;
+    write: string;
+    methods: Record<keyof NxGraphQLBaseMethodNames, string>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/nx-frame-be",
-  "version": "1.0.46",
+  "version": "1.0.48",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -16,6 +16,9 @@
   "jest": {
     "preset": "ts-jest",
     "testEnvironment": "node",
+    "testPathIgnorePatterns": [
+      "<rootDir>/build/"
+    ],
     "setupFilesAfterEnv": [
       "./src/test/setup.ts"
     ]